Vercel Internal Data Allegedly for Sale for $2M in Bitcoin

A significant security breach has allegedly compromised the internal infrastructure of Vercel, a leading cloud platform for frontend developers. According to reports emerging on April 19, 2026, a threat actor claiming affiliation with the notorious group ShinyHunters has listed Vercel’s internal database, source code, and access keys for sale on the BreachForums hacker platform. The seller is reportedly seeking $2 million in Bitcoin (BTC), with an initial starting bid set at $20,000 equivalent in the flagship cryptocurrency.

Details of the Alleged Data Leak

The hacker's post claims to offer comprehensive access to Vercel’s sensitive internal environment. The leak reportedly includes employee account permissions, API keys, and critical NPM and GitHub tokens. Security analysts note that such credentials could potentially facilitate supply chain attacks, allowing malicious actors to inject code into the thousands of websites and applications hosted via Vercel’s infrastructure.

Supporting evidence provided in the forum post includes screenshots allegedly taken from Vercel’s internal systems, specifically from the Linear project management tool and various user administration panels. These images reportedly display sensitive fields, including:

• User IDs and associated email addresses.
• Internal administrator privileges and permission levels.
• Source code repositories and backend access logs.

Vercel’s Response and Communication

Developments suggest that Vercel is actively managing the situation. Reports indicate that the company has established direct communication with the threat actor via Telegram in an attempt to mitigate the fallout and request that the hackers cease contacting Vercel employees directly. While the full extent of the breach remains under investigation, the company has begun the process of auditing its internal access logs and revoking potentially compromised credentials.

Vercel has contacted the poster via Telegram to cease contact with employees, indicating direct communication has occurred between the two parties.

The incident highlights the growing trend of cybercriminals targeting DevOps and cloud infrastructure providers to gain leverage over broader digital ecosystems. For the cryptocurrency and decentralized finance (DeFi) sectors—where many interfaces are deployed via Vercel—this breach underscores the necessity of robust security protocols and the rotation of sensitive deployment keys to prevent unauthorized access to web-based frontends.